[0:01] Good afternoon, everyone. We welcome
[0:02] you to the regular
[0:05] meeting
[0:07] of the audit committee for the utah
[0:08] transit authority. Today is monday,
[0:09] september 22 .
[0:11] our colleague beth holbrook will
[0:14] join us in a little bit and we welcome
[0:15] commissioner
[0:17] bob stevenson with us
[0:20] as well. Just a note that this meeting
[0:23] is being recorded. Live remote viewing
[0:24] for the public is
[0:26] available
[0:30] through our
[0:33] uta board
[0:36] meetings website.
[0:39] also, hold the microphone
[0:41] closely so it is picked up. Excuse
[0:42] mayor
[0:45] natalie hall who is
[0:48] unable to join us today.
[0:49] with that, we will begin with our
[0:51] safety first minute and I will turn to
[0:54] my colleague jeff acerson.
[0:57] jeff?
[0:58] >> thank you, chair.
[0:59] I appreciate the opportunity to share.
[1:00] we are at a
[1:03] season, fall. We are there. It
[1:06] is happening. We get a lot
[1:11] of moisture . The temperature has
[1:12] changed and in utah
[1:15] at least, historically, it comes
[1:18] hunting season.
[1:21] utah is
[1:24] well known for their right to
[1:25] bear arms and go after a game and have a
[1:27] good time
[1:30] and
[1:31] hunt. A lot of time it is a family
[1:33] event. I think it is appropriate to
[1:34] share some guidelines for those that
[1:36] do make that choice
[1:39] to go hunting and have guns.
[1:42] some safety items to be
[1:45] mindful of, how to
[1:46] safely store your firearms. Storage
[1:47] methods include key locks, combination
[1:51] locks, lock boxes and
[1:54] firearm safes as well. If
[1:57] you don't have access to
[2:00] a lock like that, you can go
[2:05] to your local police department. Typically
[2:06] they have those in supply
[2:09] and you can get those free
[2:11] of charge. Keep the keys out of reach
[2:12] of children and
[2:13] where others cannot find them. Store
[2:14] ammunition in a separate security
[2:18] locked container and use
[2:19] a firearm safety device such as a
[2:21] trigger lock or a
[2:22] cable lock, as I mentioned. Some basic
[2:26] firearm safety rules. Treat all firearms as
[2:27] if they
[2:33] are loaded.
[2:38] ofttimes we don't pay attention to that and
[2:39] sometimes accidents
[2:41] happen. Always keep your finger off the trigger
[2:42] until you have made the decision
[2:43] to fire. Never pointed a firearm at anything
[2:45] you are not willing
[2:48] to shoot. And, know your target,
[2:50] your target's environment and any
[2:51] other safety hazard before you
[2:54] fire and always keep the
[2:55] gun unloaded until you are ready to
[3:00] use it.
[3:02] I can just share a couple of personal experiences
[3:03] having been
[3:05] a hunter. I haven't hunted in quite a
[3:06] few years
[3:09] but it was a family event and
[3:10] you get out in the mountains and you
[3:12] get a
[3:13] lot of people out there shooting.
[3:15] you just have to make sure you
[3:17] are safe at all times because bullets
[3:21] are not --
[3:24] they go. Once they
[3:25] are fired, they go whatever direction they
[3:26] fire and they can always ricochet
[3:27] so you
[3:30] have the mindful of your target and
[3:31] beyond so you don't harm something
[3:33] you are not intending to shoot.
[3:36] okay. Chair?
[3:37] >> thank you, jeff.
[3:39] with that, we will entertain
[3:42] a motion on our consent, which
[3:43] is the approval of our minutes from
[3:45] the
[3:48] prior meeting.
[3:50] >> I will move. >> second. >> I have a
[3:51] motion from bob and
[3:52] seconded by jeff. All in favor say
[3:54] aye.
[3:55] >> aye. >>
[3:57] any opposed?
[3:58] that motion passes. Let's then go
[4:00] to item 4 on our agenda. It is
[4:03] the internal audit update. We welcome
[4:06] mike hurst, our internal audit director
[4:07] to give
[4:09] us an update.
[4:12] mike, welcome.
[4:21] >> is it working now? There
[4:24] we go. New microphones. Good
[4:29] afternoon, committee members. For the
[4:30] record, my name
[4:31] is mike hurst, director of internal audit
[4:33] for utah transit authority.
[4:34] in this first presentation I will
[4:36] give an update for
[4:39] the status of the
[4:41] 2025 internal audit plan and an update
[4:42] on the bus
[4:45] safety audit.
[4:46] >> these last
[4:48] few slides are
[4:49] lists of the individual audit engagements
[4:51] that are on the
[4:54] audit plan. On this
[4:57] slide I will highlight the
[5:00] environmental
[5:01] governments it is being performed
[5:03] by our
[5:06] internal auditors and we expect
[5:09] to
[5:12] have it by the next audit
[5:18] committee meeting.
[5:19] >> I am going to
[5:20] go
[5:21] through the slides based on my talking
[5:22] points. If there is anything I don't
[5:23] cover that you want to know about,
[5:24] please stop me.
[5:25] >>
[5:27] on this slide, you are going to get a
[5:29] report today on special services operations. We
[5:30] have
[5:33] also finished video security but not in time for
[5:34] the submission
[5:36] deadline of this
[5:39] committee meeting. We will report
[5:41] on that also in the next audit committee
[5:42] meeting in december.
[5:43] >>
[5:45] let's see. Buy american compliance,
[5:48] I am currently working
[5:51] on that. Forgive my typo here. I
[5:53] will have a report to you sooner than
[5:57] december 2026.
[5:58] >> just hedging
[6:00] your bet.
[6:01] >> I am really
[6:03] pouring a lot into
[6:06] this. No
[6:09] .
[6:10] >> you are at least ready when january
[6:11] comes around. That is what I'm always forgetting,
[6:12] the wrong
[6:14] year.
[6:15] >> yeah. It is a good thing I'm an
[6:16] auditor and not an
[6:18] editor.
[6:21] let's see. Commuter
[6:22] rail safety, the current status says not
[6:24] started but
[6:26] since submitting these files for this agenda,
[6:27] we have started
[6:30] that and we expect to have that to this
[6:33] committee for
[6:36] december 2025.
[6:37] >> mount ogden bus
[6:39] maintenance. This project, we broke
[6:40] up
[6:45] into two sections. We did
[6:46] the governance and risk management
[6:48] sections and reported on that in the june
[6:49] audit
[6:51] committee meeting and then we have
[6:52] subsequently have done the
[6:54] second part of that audit which
[7:00] is testing the rate of completions
[7:01] on preventative
[7:03] maintenance and I completed that
[7:06] last week. The results are in the
[7:07] hands
[7:09] of
[7:11] management to review and work through those
[7:12] things. We will have that second phase
[7:15] report
[7:18] in december. Then, finally, these
[7:19] are
[7:21] our
[7:24] outsource projects. We have the bus
[7:25] safety
[7:26] audit which I will give a more complete audit
[7:27] in an update and then we
[7:28] have our construction audit. Currently,
[7:33] the committee --a committee is reviewing
[7:36] the proposals. We got eight or
[7:39] nine bids on this. We will
[7:45] report back on what auditor was
[7:48] selected in the december audit
[7:50] committee meeting.
[7:51] >> the bus safety
[7:52] audit, this
[7:54] was outsourced to auditors, provided
[7:55] by
[7:56] the american public transportation
[7:57] association. They are going to be
[8:00] on site the week of
[8:02] october 6 and they will have a report
[8:03] ready for the december
[8:06] audit
[8:09] committee meeting.
[8:10] >>
[8:11] this takes us to the end of the presentation.
[8:12] are there any questions or concerns
[8:14] I can address?
[8:15] >> at this point, mike,
[8:16] it doesn't look like
[8:18] you have any concerns about things
[8:19] not being done in
[8:20] a relatively good timeframe. Does
[8:21] that
[8:24] sound right?
[8:25] >> yeah. That is definitely
[8:26] accurate. We
[8:31] keep internal tracking of the
[8:32] status of our projects relative to how
[8:33] much of the year has lapsed and we
[8:34] are in
[8:35] a really good place right now and
[8:39] we expect to fully complete the 2025
[8:43] audit plan
[8:46] within the --not
[8:49] calendar but
[8:50] --week of march to february. We will
[8:52] have it all finished
[8:53] before february.
[8:54] >> any other questions
[8:55] for mike on
[8:58] this part? It doesn't look
[8:59] like it. Thank you.
[9:00] >> thank you.
[9:01] >> then,
[9:04] let's see. Going to the
[9:05] open audit recommendations report.
[9:07] mike?
[9:12] >> great. So, this presentation is a
[9:13] report on
[9:16] the status of
[9:18] open audit issues and recommendations. This
[9:19] is a report
[9:22] that we give every
[9:27] committee meeting . We have closed
[9:29] one issue since the june audit committee
[9:31] meeting. That
[9:34] was
[9:37] issue r-22-06-4
[9:38] which is a recommendation that controls
[9:39] around support vehicle custody and
[9:40] key security be
[9:44] improved. Historically, keys for our support fleet
[9:46] vehicles were kept hanging on
[9:49] a pegboard type thing in
[9:52] an unlocked lockbox
[9:53] just out in the hallway. Since that
[9:55] time,
[10:00] management has purchased and installed
[10:01] an electronic check out and check
[10:04] in and key management system. I
[10:07] tested that system
[10:10] out to make sure that
[10:12] it assigns proper custody, that only approved
[10:13] users can check
[10:16] out a vehicle and that
[10:17] keys are secured unless it is authorized
[10:22] for use. I
[10:23] threw a lot at this, trying to break
[10:25] it, so to speak and it
[10:28] held up, at least to me. I think it
[10:31] is in
[10:33] good shape and they have taken some
[10:36] strong steps to secure this valuable
[10:37] asset.
[10:42] >> mike, is that type of control at
[10:43] all of our
[10:46] facilities that have support
[10:49] vehicle thing? I
[10:50] just don't know how many --I assume
[10:52] that everyone
[10:54] of our maintenance facilities have
[10:55] something similar but not to
[10:57] the same extent, right?
[10:58] >> I focused
[10:59] on the controls here
[11:01] at the
[11:04] headquarters building. As I
[11:05] understand it, and if anyone in management
[11:07] knows
[11:10] differently, fl
[11:13] hq has most of the support fleet
[11:15] vehicles that are floating that can
[11:16] be
[11:21] checked out. I think some of the locations have
[11:22] some but
[11:25] those are primarily signed out to
[11:26] individuals.
[11:27] >> those vehicles are typically assigned
[11:28] already. They have a
[11:31] responsible party for
[11:33] them.
[11:34] >> we better have use your microphone.
[11:35] >> is
[11:37] there any problem with over demand
[11:40] for
[11:42] these vehicles? Is there always a
[11:43] vehicle available for those
[11:45] who want it? Does anyone know the
[11:46] answer
[11:49] to that?
[11:50] >> we have not had a problem where
[11:52] we have not been able to meet
[11:53] the demand of the vehicles.
[11:54] >> my
[11:55] next question is, do we have too
[11:57] many vehicles?
[11:58] >> that is something
[11:59] that our vehicles team
[12:00] was always looking out. We have retired
[12:01] a number
[12:05] of vehicles. That is something we
[12:07] always look at.
[12:08] >> I think it was
[12:10] an issue two
[12:13] years ago .
[12:14] we have made some changes.
[12:15] >> that
[12:16] was part of the analysis process
[12:17] we went through to right size it and
[12:19] make sure we get efficient use out
[12:20] of it.
[12:21] >> one of the issues from this audit
[12:22] that is still open is
[12:25] about right sizing
[12:28] the fleet
[12:30] . And, about having processes in place
[12:31] to ensure that we have the right
[12:32] number in the right time of vehicles
[12:34] in place and
[12:35] management has taken some strong steps
[12:37] toward that
[12:40] and are developing policies
[12:45] and procedures to make sure that we
[12:46] have a good
[12:52] balance of the rain
[12:55] number of vehicles but also
[12:57] good availability.
[12:58] >> does that answer
[13:04] your question?
[13:05] >> let's
[13:06] see. The current status of open issues.
[13:07] there are currently 37 open issues.
[13:08] here is
[13:10] just
[13:13] a breakdown
[13:15] by cheap office, 10 are in capital service,
[13:16] 10 in
[13:22] operation, 10 in the people office, six
[13:23] in
[13:24] finance and then one is shared by
[13:25] enterprise strategy
[13:31] and operations
[13:34] . Another way to break that down is
[13:35] by year.
[13:36] three in 2020, seven in 2021, six
[13:37] in 2022, 16 in 2023, three 2024 and
[13:40] two from 2025.
[13:42] another --this is on the slide but
[13:43] it may also be instructive
[13:46] to know
[13:48] that the risk rating on those. For
[13:52] each of the
[13:54] audit issue, we ranked them as high, medium,
[13:55] or low
[13:57] based on the severity of the issue
[13:58] and the relative importance of
[14:01] it. Out of
[14:03] those 37, 12 were rated as high, 20
[14:04] as medium and five
[14:07] as low.
[14:08] >> or any of
[14:10] the ones from
[14:13] 2020 or even 2021,
[14:16] are those high at all? Do
[14:19] you know?
[14:22] mostly when I am going for
[14:24] there, high risk issues that have been
[14:25] around
[14:28] for a
[14:29] long time. If you don't have that
[14:31] answer right now, you can come
[14:33] back to this later.
[14:34] >> christi, do
[14:35] you have that information?
[14:37] I don't know if you want to
[14:40] come up.
[14:41] >> we would need
[14:42] you to come up and use the microphone,
[14:43] christie. We would love to hear your
[14:44] response.
[14:45] >> while she comes up, I can read them off
[14:46] real quick.
[14:49] >> sure. >> the three in 2020 are medium,
[14:54] high, medium and in 2020 when we have
[14:55] medium, high, medium, medium, medium, medium,
[14:56] high.
[15:00] >> okay. >> I don't know that you need
[15:01] me to add to
[15:04] that.
[15:05] >> it
[15:07] is not -- are we
[15:08] actively working on these issues?
[15:09] are some of the issues open because
[15:10] we
[15:13] don't have moved forward with the
[15:14] correct information
[15:15] to audit? Can you give us -- we are
[15:16] working on this
[15:19] with mike, give the committee a better
[15:20] understanding of where
[15:22] we
[15:24] are at?
[15:25] >> for the record, I am christie giles,
[15:26] the 10 risk management administrator
[15:27] and we do work closely with mike and we
[15:34] do check in on the open issues with
[15:36] the issues owners every month. They
[15:37] are getting constant attention. In
[15:38] some cases,
[15:40] in fact, in most cases, with these issues that are
[15:41] older, they have been
[15:44] escalated to chief
[15:47] level recently because in some places we
[15:49] need a little bit higher authority
[15:50] to
[15:53] make decisions and to
[15:56] take actions
[15:59] around these issues
[16:00] that are assigned to a lower leadership
[16:01] level so we are finding that we need
[16:02] to
[16:03] do a little more escalation to the
[16:04] right level to address the issues
[16:05] but they are getting
[16:08] constant attention.
[16:09] >> I
[16:10] guess, and I apologize because I have
[16:11] been gone a lot, within the last few
[16:12] weeks, I did not get a chance to look
[16:14] through
[16:16] the details. Getting escalated is
[16:18] one thing, taking action or figuring
[16:20] out a
[16:26] claim plan -- game
[16:27] plan to resolve it is a different thing. This
[16:29] would be helpful to know what
[16:30] the game plan is, at least on those
[16:32] 20 and 21
[16:37] issues.
[16:38] >> the status updates are
[16:39] accurate.
[16:40] the status updates are provided by management
[16:41] in every report in detail the action
[16:42] plan that is underway.
[16:47] >> absolutely. >> I will
[16:49] commit, chief carlton, that the december meeting,
[16:50] we will have
[16:53] a report. I would like a report
[16:55] on 2021 and 2022 to see where we are
[16:56] on each
[16:58] of those.
[16:59] >> okay. That is helpful.
[17:00] thank you.
[17:02] anything else on that, mike?
[17:05] >> no. Any other questions for
[17:08] him? Okay.
[17:09] >>
[17:11] with that, why don't we go on to
[17:14] internal
[17:17] audit report. The first item
[17:20] up is our light rail
[17:23] safety audit. I think travis king
[17:24] is going to join you. Does that sound
[17:26] right?
[17:27] >> yeah,
[17:31] he is.
[17:32] >> travis, we should have you introduce
[17:35] yourself too.
[17:36] >> good afternoon,
[17:37] travis king, director of safety and
[17:41] security.
[17:42] >> to quickly set
[17:45] the stage for what this audit is,
[17:47] this is an auditor
[17:48] that we internal audit perform on
[17:50] behalf of state safety
[17:53] oversight. They
[17:56] provide checklists that
[17:59] originally published
[18:02] by the fta to give us subjects
[18:04] and procedures that they want applied. They
[18:10] set the period of review. Also, unique to this
[18:14] audit is internal audit is
[18:17] strictly fact finders in
[18:20] this. We report the
[18:23] results
[18:24] and then the state safety oversight
[18:26] works with our
[18:27] safety management to determine what
[18:29] observations from the audit require
[18:32] corrective action
[18:33] and what that corrective action will
[18:35] be. This presentation
[18:38] will be more limited in
[18:41] the scope because of that
[18:44] reason. Internal audit
[18:45] does not issue recommendations for
[18:47] this audit the
[18:50] way that we do in a typical audit.
[18:53] this covers calendar year 2024 and
[18:55] then I won't read them all but those
[18:56] are the
[19:00] audit topics. A couple I will point
[19:02] out are the second bullet, transit
[19:05] agency safety plan updates. We
[19:08] did quite an extensive review of
[19:10] the task. That is the acronym. We
[19:17] reviewed the
[19:22] tasp. Halfway down, maintenance audits
[19:23] and inspections. We look
[19:24] at the way they handle preventative
[19:26] maintenance for our light rail vehicles
[19:27] and
[19:29] tested their compliance with those
[19:32] preventative
[19:33] maintenance schedules. We also looked
[19:35] at our
[19:38] security system. We looked
[19:41] at the security system plan. We
[19:44] reviewed that document and some other aspects
[19:47] of the
[19:50] security program.
[19:51] >> we completed this audit on june
[19:53] 30, 2025 and then
[19:56] a report was issued to state
[20:01] safety oversight. I will turn it over to
[20:02] travis king to report
[20:05] on what next steps are.
[20:08] >> yeah. Thank you, mike.
[20:10] I would also like to express my gratitude
[20:11] to the
[20:14] internal audit team. They have been
[20:15] a great job in helping us establish
[20:17] best practices in helping us do
[20:20] this review. Essentially, as
[20:22] mike explained, this is a breakdown of
[20:23] the same
[20:29] review that the fta does
[20:31] of us when they come in and do their triannual. We split
[20:32] it up into three
[20:34] different bases and cover a three-year period. Next steps,
[20:35] now that we have the
[20:38] results
[20:41] from mike's team, we are working closely with
[20:42] the sso to
[20:43] make a determination. If there was
[20:50] a finding
[20:53] , those will follow our hazard
[20:54] management process plan and will be
[20:56] issued a corrective action plan that
[20:57] will be
[20:58] approved by the state safety oversight
[20:59] and will be worked through and then
[21:00] closed out with
[21:01] the approval and help from the state
[21:02] safety oversight. Any recommendations,
[21:03] which are essentially
[21:04] best practices, will be reviewed and
[21:05] analyzed to determine if
[21:08] a corrective action plan is needed
[21:09] or if
[21:11] a lower mitigation
[21:14] is appropriate in that case all with
[21:15] the
[21:17] assistance and approval through
[21:20] the sso.
[21:23] >> just making sure it is clear for
[21:26] the record, the sso means what?
[21:28] >> I apologize pick the sso stands
[21:29] for the state
[21:32] safety oversight which
[21:34] is overseen by udot, the current assigned
[21:35] state oversight is peter jaeger.
[21:38] >>
[21:41] okay. Questions?
[21:42] >>
[21:44] thank you.
[21:45] >> I do
[21:47] have one.
[21:48] >> you
[21:50] said you completed the audit --
[21:53] bob is your --sorry.
[21:54] >>
[21:59] you said that you completed the audit on
[22:01] june 30. Okay? That was a few months
[22:02] ago. Are some of
[22:05] these
[22:08] audits too large with not enough staff to
[22:09] be able to
[22:10] complete in a timely manner or do
[22:11] you feel that that is a timely manner?
[22:14] how would you weigh
[22:17] that out? I know that is an
[22:20] open question. But be honest.
[22:21] >> they
[22:22] are
[22:23] very manageable. Very manageable audits.
[22:29] a typical --audits are
[22:30] not a homogenous product. They are
[22:32] not one-size-fits-all but these
[22:35] probably take -- I would
[22:38] guess two months to
[22:40] complete. State safety oversight,
[22:41] correct me if
[22:47] I misspeak ,
[22:48] travis. State safety oversight once
[22:50] the results early enough in the year
[22:51] that they
[22:53] can have
[22:54] corrective action plans in place by
[22:56] january. At least that is
[22:58] my understanding. So, I did this audit
[22:59] myself. I
[23:02] started it in late
[23:05] march,
[23:08] early april, we completed it
[23:11] june 30. And, as I
[23:14] understand it, that is plenty of time for
[23:15] state
[23:21] safety oversight
[23:23] to develop the corrective action plans and
[23:24] then as far
[23:25] as resources on my side, that was
[23:26] another part of your question. No,
[23:27] it
[23:29] wasn't a burden. We had planned for
[23:33] this and I was able to complete
[23:36] the audit as well as all of
[23:37] my other responsibilities during that time
[23:38] without any other issue.
[23:39] >> okay.
[23:42] >> good question. Thank you.
[23:45] >> with that, we
[23:47] will move to our special services
[23:51] operations
[23:54] audit. Mike, it looks like
[23:55] he will be joined by ryan taylor. Does
[23:57] that sound right?
[23:58] >> yeah. Ryan taylor and then also
[24:02] joanna gossen. I will let both of
[24:03] them introduce themselves
[24:05] for the record.
[24:06] >> hello, committee.
[24:07] I am
[24:12] joanna goss, one of the senior
[24:13] internal auditors for the uta.
[24:14] >>
[24:15] I am ryan
[24:16] taylor, general manager of special services
[24:18] at
[24:24] uta.
[24:25] >> first, special services
[24:27] operations audit. Our scope
[24:33] was dedicated to
[24:34] the four different areas. First is the
[24:36] governance of special
[24:38] service operations. The second would be
[24:39] staff training
[24:40] and oversight. Third would be the
[24:42] scheduling process that is utilized
[24:45] by special service
[24:48] operations in creating
[24:51] daily schedules for the
[24:54] routes
[24:55] and to fulfill our paratransit needs
[24:57] and then
[24:58] fourth would be the participation
[25:00] and
[25:03] risk management. Excuse me.
[25:04] I got the order wrong. It is on the
[25:05] slide there. Regardless, that was
[25:06] the
[25:09] scope of this
[25:12] audit. Hour period of review was
[25:15] january 2022 to february of this
[25:18] year, 2025. Any questions
[25:24] so far?
[25:27] >>
[25:30] all right. For our recommendations,
[25:33] the first and that we
[25:36] ended up doing was reviewing our
[25:38] safety-related standard operating
[25:39] procedures for special
[25:42] services and found that
[25:45] many had not been
[25:48] completed within
[25:50] a five-year timeframe so we had made the
[25:54] recommendation that two
[25:55] special service operations, to work
[25:56] with our safety team to a date these
[25:59] standards of procedures so that we
[26:00] could have effective
[26:03] and relevant standards of
[26:06] siege are.
[26:09] any questions regarding
[26:12] the
[26:15] sop?
[26:16] >> may be looking to
[26:18] ryan for a response and how that
[26:20] gets accomplished?
[26:21] >> we have set
[26:22] up
[26:24] a working group to review all of
[26:26] our sop's, concentrating first and
[26:27] foremost on the
[26:28] safety sop's which have been identified.
[26:30] they are doing
[26:33] that work currently and we
[26:39] are on
[26:41] schedule to have draft revisions submitted
[26:42] by november 1 which
[26:43] will review and we should have those
[26:45] completed by december 1 of this year.
[26:46] >>
[26:47] maybe
[26:48] it is too early to tell but are you
[26:49] looking at significant changes
[26:51] or refinements
[26:54] based on
[26:55] more current guidance?
[26:56] >> many of
[26:57] the processes are current. They may
[26:58] be
[26:59] old. We haven't deviated from that
[27:00] work over
[27:03] the
[27:04] past decade. The regulations for paratransit
[27:06] service has not really
[27:08] changed significantly. We are finding
[27:09] areas where
[27:12] we can tidy
[27:13] some of those sop's up and make some
[27:15] of those current but we
[27:18] don't see any major revisions of
[27:21] those.
[27:22] >> any
[27:24] further questions? Our
[27:30] second recommendation
[27:31] that we came up with after reviewing
[27:33] off the job descriptions held within
[27:36] special
[27:38] service operations was that some of
[27:39] these job descriptions had not
[27:42] been up dated in at least
[27:47] five years. We recommended that special
[27:48] service operations review these with
[27:51] human resources or our
[27:53] people office in order to update these
[27:54] the way that
[27:57] made them relevant
[28:00] to 2025 and
[28:06] moving forward. Then, the list,
[28:07] obviously the list of the job descriptions
[28:09] are there on the slide.
[28:10] >> we
[28:12] also agree with
[28:18] this finding
[28:20] and have tasked our managers for those respective
[28:21] job descriptions, to go through
[28:22] those. We have been doing that on
[28:24] a case-by-case basis so when a job
[28:25] opening happens, typically the hiring
[28:26] manager will at least review that
[28:27] to see if there
[28:28] is anything that has had any major
[28:30] changes but we are going through and
[28:31] redlining
[28:32] any of those to update those and our
[28:33] target date for completion
[28:36] is to have
[28:39] all the description reviewed
[28:40] by january 1 and complete those updates
[28:42] by
[28:45] february 15.
[28:46] >> any
[28:47] questions? Jeff?
[28:48] >> it sounds like it
[28:49] was more
[28:53] as needed and this way you are getting
[28:54] a full look and
[28:56] trying to make sure these are up to date.
[28:57] >>
[28:58] rate.
[28:59] >> sounds great.
[29:00] >> it probably only helps you later
[29:01] on when
[29:02] you go to host if you are not having to
[29:03] do it.
[29:06] >> absolutely.
[29:08] >> moving onto the next slide, we
[29:09] reviewed some data that special
[29:11] services collects in order to create
[29:12] goals and
[29:15] to maintain compliance
[29:18] with fta regulations. Within
[29:21] this data,
[29:23] it is noteworthy that even with an
[29:24] increase in ridership
[29:27] throughout the reporting
[29:28] period, special services has supported
[29:30] a higher rate of
[29:32] on-time performance for operators
[29:36] and maintain low rates for missed trips
[29:37] and trips
[29:39] taken over 90 minutes, which
[29:42] is commendable. Some of the data that we reviewed
[29:45] suggested that average
[29:48] hold times for customers calling in
[29:49] to create a
[29:51] trip had increased
[29:57] and that --there is
[30:00] an increase in calls that were over
[30:01] two
[30:03] minutes. We have made the
[30:05] recommendation that management reevaluate staffing
[30:06] needs
[30:09] to assess if
[30:12] increased staff would ensure average
[30:13] call times and then
[30:18] also review
[30:21] the call time in general over two minutes
[30:23] to see if there were needs of re-addressing
[30:24] those goals or looking into that
[30:27] as well.
[30:28] >> do all scheduling have
[30:29] to be
[30:30] done through
[30:33] an operator?
[30:36] is there an option
[30:38] or something where they can schedule
[30:39] something --
[30:40] >> really, all calls and
[30:41] reservations go through our call center.
[30:42] that is correct. We are looking at
[30:43] a technology solution for
[30:44] a self-service portal that we would
[30:45] hope could come
[30:48] online next year.
[30:51] >> okay.'s tee we do have
[30:54] a small call center of nine reservation
[30:57] agents. It is our obligation
[31:00] to that fta and
[31:03] all of the regulations
[31:05] regarding ada and paratransit that
[31:06] we can take
[31:08] any trip reservations up to the day before
[31:15] the service
[31:21] . So, that operates 24/7. For example,
[31:22] when we are closed on christmas day,
[31:24] we need to be able to take reservations
[31:25] for
[31:26] the day after so we have staff available
[31:27] for that. During this time, we
[31:29] did have some turnover in that department and
[31:30] we were short a
[31:32] few individuals and we have hired
[31:35] staff there who are in training. Because of the
[31:36] complexity of looking
[31:39] those
[31:41] trips, we do have conditions of eligibility
[31:42] for a lot of our individuals. It
[31:45] does take a good amount
[31:48] of time for someone to
[31:51] become proficient in that job and
[31:52] we are
[31:53] in the process of training those individuals
[31:54] and also working with the
[31:57] business analysts, ensuring that
[32:02] our data on those calls is correct
[32:03] on the hold times to make
[32:06] sure that we are in compliance
[32:10] with
[32:11] that.
[32:12] >> is there -- maybe you answered the question
[32:13] -- is there a way for customer service
[32:15] to take rollover calls for you or
[32:17] not really?
[32:18] >> no. With the complexity
[32:19] of the trips, it is
[32:22] very specific for those ada
[32:28] paratransit trips.
[32:31] it is specific
[32:32] to each individual booking that.
[32:33] >>
[32:34] when you are fully staffed, do you meet the
[32:35] thresholds?
[32:36] >> whatever our commitment is.
[32:37] >> it ebbs
[32:40] and flows. When you have a staff
[32:42] of only nine reservationists and four
[32:44] leader reservationists and you are
[32:45] open basically business hours seven
[32:46] days
[32:49] a
[32:50] week, you are trying to manage those calls
[32:52] when you have people who
[32:55] call out sick or
[32:56] are on vacation and you have limited
[32:58] staff, that also limits
[32:59] our availability. Our lead schedulers who
[33:01] take escalated calls
[33:04] and do a lot of
[33:06] the training, they jump in on the
[33:07] call too. They are actively
[33:10] monitoring
[33:11] that to see how many calls we have on
[33:13] the q and can
[33:14] jump in and mitigate that when they see that
[33:16] going too
[33:19] long.
[33:20] >> I am sure you are
[33:22] mindful of this. When I
[33:25] hear automation, there tends to be a
[33:26] little less of the human characteristics
[33:31] of that and I would think the
[33:33] clientele that take advantage of this,
[33:34] there is
[33:37] probably an enhanced need to make
[33:40] sure they feel like they
[33:41] are connecting. I don't know if any
[33:43] of you had been on the
[33:44] other end of an automated call but
[33:46] sometimes it can become a
[33:47] little frustrating. I am sure you
[33:49] are being mindful
[33:51] of that and whatever system you move
[33:54] forward with, it will take into account that
[33:58] need to make sure
[33:59] that there is still the ability to
[34:01] communicate
[34:03] directly if needed.
[34:04] >> absolutely.
[34:05] we will always make
[34:07] sure that that is available
[34:10] for individuals. A little bit of background
[34:11] on the system we are looking at. It
[34:13] is a web based portal where
[34:14] an individual can log on to an internet
[34:16] site. They will have to have
[34:18] their credentials and they can only
[34:19] book trips for
[34:20] themselves or a caregiver can book it
[34:26] for them. Then, that still has to
[34:27] be evaluated. That will actually shorten
[34:28] the process
[34:29] for many people and they can do it
[34:31] on their
[34:34] own time. We are excited
[34:37] about that, to have it as a
[34:38] elementary product.
[34:39] >> some of the
[34:40] groundwork can be pre-done so when
[34:41] they get to the queue or that , it
[34:43] helps everybody.
[34:44] >>
[34:46] correct.
[34:49] >> thanks. >> okay. For our
[34:53] next recommendation, actually moves
[34:55] right into
[34:58] the
[34:59] scheduling. From my perspective as
[35:03] an auditor, the scheduling process
[35:04] for special
[35:06] service operations, to ensure that
[35:07] we are
[35:08] fulfilling our ridership needs is incredibly
[35:10] dynamic. We are
[35:13] dealing with a diverse group
[35:19] of individuals , calling in, requiring
[35:20] operation supervisors and scheduling
[35:22] staff to quickly review
[35:23] incoming information. That is being
[35:25] bombarded at them throughout the
[35:28] day. And, the need to plan
[35:30] these routes every single day 48 hours
[35:36] in advance in a way that best serves our customers and also
[35:38] balances the workload of available operators
[35:40] and available routes within
[35:43] the system. In looking at
[35:49] how dynamic this process is and
[35:52] how well the team is working on
[35:54] managing that with all of the different
[35:55] needs,
[36:00] we suggest --we recommend that management
[36:01] should formalize the procedure as
[36:02] a standard operating procedure rather
[36:03] than rely on the wonderful communication
[36:04] on the
[36:10] teams there. A way that patient
[36:13] won't
[36:16] be lost
[36:18] in the case that everyone wins the lottery
[36:19] and decides to
[36:20] walk away. A recommendation here would
[36:21] be for management to formalize the
[36:22] scheduling process and
[36:25] the standard of
[36:27] procedure document.
[36:28] >> we also concur with
[36:30] that finding. I think that one of
[36:34] our opportunities is in our
[36:37] formal documentation and
[36:40] I think that is probably an area that needs the
[36:41] most amount
[36:43] of work. We have all
[36:46] you
[36:47] formulated --also related a working
[36:48] group and they are currently meeting
[36:49] and working
[36:52] on this process and
[36:53] the target date for completion is
[37:01] april 1.
[37:02] >> then, for
[37:07] our last --I'm
[37:08] sorry. Were there any further questions?
[37:09] >>
[37:10] I don't think so.
[37:11] >> for our last recommendation,
[37:12] we
[37:13] reviewed our cdl licensure of employees
[37:14] and
[37:16] the system in which we are keeping those
[37:21] records here and employee license
[37:22] records that are entered
[37:24] into udot's system, which is the system
[37:25] we
[37:28] rely on with our
[37:30] acquisition team, with our people
[37:33] office team, the records are inaccessible
[37:34] or not as accessible to
[37:39] operations services --service units,
[37:40] excuse me.
[37:43] that
[37:44] prohibits records and monitoring and
[37:46] a proactive notification to
[37:49] employees when their licensing
[37:52] is expiring. We make the
[37:57] recommendation here that in order for us
[37:58] to be
[38:01] more secure in
[38:02] these records that we come up with
[38:07] a way so that our talent
[38:08] acquisition and our people office
[38:10] can share
[38:11] these records with the operations
[38:16] business units.
[38:17] >> I can't imagine this
[38:19] is limited to special services,
[38:21] though, right? How do we check the
[38:22] rest of our cdl?
[38:23] >> I would
[38:24] have to bring up andrea's pullman
[38:25] to see how we are
[38:28] doing that.
[38:31] >> are you getting
[38:34] expired cdl? You would probably have
[38:35] to
[38:37] pull that down toward
[38:40] you too.
[38:41] >>
[38:42] the light isn't on. We received routine
[38:43] reports from
[38:46] the people
[38:49] office and
[38:50] our senior office specialists review
[38:51] those. They schedule appointments
[38:52] ahead of time for
[38:53] cdl holders. I think the challenge
[38:55] comes when
[38:58] things happen in between those reporting
[38:59] periods
[39:01] but
[39:04] we do monitor. We schedule these
[39:05] appointments for our employees and we
[39:07] do a good job at it but
[39:09] there are sometimes gaps because we
[39:10] don't have access in real-time
[39:13] to
[39:16] the information.
[39:19] >> so, it sounds like it is not just
[39:20] a special services challenge.
[39:21] >> that
[39:22] is across all services.
[39:23] >> I wonder if
[39:24] udot
[39:25] or somebody would
[39:28] help share real-time access.
[39:29] >> we will
[39:31] work with a team.
[39:34] >> anyway. >> on this
[39:39] particular one, the lead, they have
[39:40] an action plan put in place
[39:41] for that where each of the service
[39:42] units will provide subject matter
[39:43] experts
[39:45] to assist on our sides to help them
[39:46] craft
[39:48] a solution.
[39:49] >> okay. Anything else?
[39:52] >> absolutely. This concludes --unless
[39:54] there are other questions from the
[39:55] committee.
[39:56] >> I don't see
[39:58] any.
[39:59] >>
[40:00] thank you.
[40:01] >> ryan, thanks for those
[40:02] goals and I look forward to
[40:04] the follow-up is.
[40:05] >> purchase card
[40:07] program
[40:10] audit.
[40:13] welcome. Welcome our
[40:16] colleague, beth. Welcome. Mike, I
[40:17] guess viola
[40:19] miller ,
[40:22] you will be joined by
[40:25] anybody else?
[40:27] >> yeah, yeah. We also have luke barber,
[40:28] one of our senior internal
[40:30] auditors.
[40:31] >> okay. Great. We will
[40:32] turn the
[40:34] time to you.
[40:35] >> we will go ahead and
[40:37] take it.
[40:38] >> luke barber, senior
[40:40] internal auditor. We have the purchase
[40:41] card
[40:44] program audit. It
[40:47] took place mid part of the year
[40:50] and ended
[40:53] back in -- well, right in
[40:54] august. We got the report locked out.
[40:56] it is a pretty
[40:59] big program. The
[41:01] audit scope was from that period of
[41:02] september
[41:05] 1, 2021 through february
[41:08] 28,
[41:11] 2025. Just to address the
[41:14] dates there, that is when we switched the
[41:16] uta to using u.s. Bank as our card management
[41:19] bank. We recorded the duration of
[41:20] that and
[41:23] the audit topics were
[41:25] the governance over the program with
[41:28] a compliance with any laws and within
[41:32] our own sop's. Various
[41:34] transaction testing, we looked at
[41:35] the
[41:38] different
[41:41] transactions and some analytics as
[41:43] far as how certain transactions were
[41:44] handled. The scope also included a
[41:47] risk
[41:48] management portion. We don't have
[41:52] a slide.
[41:53] >> sorry, that should say
[41:54] the
[41:56] scope did not include
[41:58] risk management.
[41:59] >> we don't have
[42:02] a slide addressing this
[42:05] but our program is quite large,
[42:06] something to bear in mind. We have
[42:11] approximately
[42:12] 500 p cards within our system. They
[42:13] are used for smaller purchases that
[42:14] don't require direct
[42:17] oversight from
[42:19] accounts payable. There is about 1
[42:20] million to 1.2
[42:21] million in spending per month that
[42:23] goes through that and if we did
[42:24] away with the program that would all
[42:26] fall on ap
[42:29] and I am sure that would be a
[42:31] big burden. With that being said,
[42:32] we will
[42:35] jump in --
[42:36] >> do you have a total number
[42:39] of annual p card transactions? Do you
[42:41] have
[42:44] that report?
[42:45] >> I
[42:46] had an estimate in the introduction
[42:47] of
[42:53] the report.
[42:57] the most recent annual spend was about
[43:02] 13.5 million.
[43:03] >> that was about
[43:05] a year of 2024 calendar
[43:11] year.
[43:12] >>
[43:13] can I ask a quick question? Sorry, I
[43:14] was late
[43:15] to the party. Thank you for everybody. On
[43:17] the good news, the city
[43:18] did obtain their. I had a question
[43:20] on your transaction testing.
[43:23] structurally, do you
[43:26] --is there a percentage that
[43:28] you attempt to understand? Do you
[43:29] do specific dollar
[43:30] figures or specific months? Maybe
[43:32] you could just talk about how
[43:35] you navigate the specifics
[43:38] on that?
[43:39] >> within transaction testing,
[43:41] we looked at it from a few different
[43:42] angles. One of them is running analytics
[43:44] to provide to management in determining what our
[43:47] biggest spend
[43:50] areas were
[43:51] . We provided a table with information
[43:53] as far as what the spend is per
[43:54] area. We can provide that or it is
[43:56] in the report
[43:59] as well. We also looked
[44:02] at, based on risk, what areas
[44:05] would be a
[44:10] higher risk type item. One of the policies
[44:11] that we
[44:13] looked at is having things shipped,
[44:14] directly to a uta address rather than
[44:17] a
[44:18] non-uta address. We looked at transactions
[44:20] that were sent outside of the
[44:26] uta address
[44:29] . In addressing your question, kind of
[44:30] yes. We looked at
[44:31] all of those things from different
[44:32] angles.
[44:33] >> there is not a percentage,
[44:38] per se?
[44:40] just a strategy to know where you're
[44:41] more potential risk
[44:42] factors are. With that be accurate?
[44:44] >> yeah.
[44:46] >> thanks. >> if you have a p card
[44:47] --
[44:48] >>
[44:49] do I have one?
[44:50] >> no. Just hypothetical.
[44:51] if you have a
[44:55] p card, and your supervisor, will he
[44:56] go through your charges at
[44:57] the end of your billing period?
[44:58] >>
[44:59] by policy, they should
[45:02] be reviewed.
[45:03] >> due to
[45:05] the large scale
[45:08] of the program,
[45:13] you have two options. One would be to
[45:14] hire staff that
[45:17] could directly monitor all of
[45:18] the transactions. I don't know if that
[45:20] would be super effective the other
[45:21] one
[45:23] is relying on supervisors and middle
[45:24] management
[45:25] to actually review the transactions
[45:29] and
[45:30] approve other people's transactions.
[45:32] >> are there receipts and other things
[45:33] attached
[45:35] to them?
[45:36] >> there
[45:37] should be.
[45:38] >> we will address that.
[45:39] there are a few findings
[45:44] on that.
[45:45] >> I think we will also note
[45:50] that the
[45:53] numbering on
[45:54] this doesn't flow exactly and that is because
[45:56] there are a few items that were more
[45:57] sensitive in
[45:58] nature and so those will be addressed
[45:59] in a closed session after this.
[46:00] so, the first one we are reporting
[46:05] on is audit finding 25-03-02
[46:07] and the issue was that there was one
[46:08] open purchase card that belonged to
[46:09] a
[46:11] terminated employee.
[46:14] we did not find any
[46:17] evidence that
[46:18] a fraudulent or any spending was done
[46:20] after they had left uta employment
[46:21] but that
[46:22] is obviously a risk because it was
[46:23] open. You can use it
[46:28] for possible online purchases, et cetera.
[46:29] >> could you
[46:31] clarify if they had returned the card
[46:32] to their supervisor or
[46:34] if they literally took the card with
[46:35] them accidentally? I am just going to
[46:38] presume accidentally. Can you not
[46:40] specify?
[46:41] >> we were not able to determine
[46:46] that. The office takes care of that and
[46:47] gets the card so management, I
[46:49] think, addressed that and said they
[46:50] were able to determine.
[46:51] >>
[46:56] go ahead.
[46:57] >> so, yes,
[46:58] we were able to determine that no
[46:59] charges were made after the fact but
[47:00] we
[47:01] are working with the people office
[47:02] to make sure that
[47:05] we get notified when people are terminated
[47:06] if they
[47:08] have
[47:11] a card.
[47:14] >> okay.
[47:15] so, the recommendation there were that
[47:16] management should coordinate with
[47:17] people office, which they
[47:20] are working on and then consider
[47:22] creating an automated system that might
[47:23] notify if that
[47:29] is needed when an
[47:30] employee leaves. And then, having the
[47:31] p card administrator periodically
[47:32] reconcile or create
[47:33] some kind of a tracking mechanism to
[47:35] ensure that only active cardholders
[47:36] are
[47:40] current employees. Any additional
[47:47] questions there?
[47:48] >> okay. Then we
[47:49] are
[47:50] going to go to
[47:53] finding 03-05. The issue here was
[47:56] at 137
[47:59] cardholders or --speaking to the question
[48:01] that bob had earlier. There are cardholders
[48:05] and then there can be within the system
[48:06] just transaction approvers.
[48:07] they may not have an actual card but
[48:08] they log into the
[48:11] u.s. Inc. System
[48:13] and they are able to view those and
[48:14] approve them. So, a
[48:16] total of 137 card elders were approval
[48:17] had not completed the training that
[48:18] is available called
[48:20] basic purchase
[48:24] card training.
[48:28] >> I did not think there was an option. I
[48:30] thought it was part of
[48:33] the
[48:35] training module requirements.
[48:36] >> part
[48:37] of the issue
[48:38] here is that the training module requirement
[48:39] is only for
[48:40] the cardholder. We are working on
[48:42] updating that now.
[48:48] >> okay. >> so, just
[48:51] for clarity. You can be
[48:55] an approver and not be a cardholder.
[48:57] >> not actually have
[48:58] a card.
[48:59] >> exactly. >> it is really
[49:00] be
[49:01] approver that is missing the training?
[49:03] >>
[49:06] yes.
[49:07] and, where we have annual training requirements, some
[49:09] people are not meeting those.
[49:14] >> okay. >> there should be some clarification. The
[49:15] issue that
[49:17] we looked at was more in the calendar
[49:18] year
[49:19] or from starting january 1 of 2024
[49:21] and rolling through the end of
[49:23] the audit dates. We did not look at
[49:29] the historical.
[49:30] >> if somebody did not
[49:31] complete
[49:33] their training of the card, you
[49:34] can suspend the card?
[49:35] >> they will
[49:36] get notification if they
[49:37] do not pay it within the 30 days.
[49:39] the card will
[49:44] be suspended.
[49:45] >> with that, our recommendations
[49:46] were that
[49:47] policies and sop's be updated to clearly mandate
[49:50] the annual training for the cardholders
[49:51] and
[49:53] the approvers. Then, also identify
[49:54] cardholders
[49:57] and approvers who have not
[50:00] completed it in
[50:01] the past year and require that completion. Or,
[50:03] as they said, they can
[50:06] suspend the card. Any additional
[50:09] questions there?
[50:12] >> our next one, the
[50:13] issue was training for specifically
[50:15] transaction approvers does
[50:21] not exist
[50:26] . Currently there is just that p card
[50:27] basic training and
[50:28] it seemed that there might be an opportunity
[50:29] to provide some additional training
[50:30] for those who don't
[50:31] necessarily have an p card but are
[50:32] required to review those and those
[50:33] transactions
[50:36] and then approve
[50:39] them.
[50:40] >> what is
[50:45] your response?
[50:46] >> yes,
[50:47] we absolutely are working on this as well.
[50:48] first, I just want to go back in general
[50:50] and to say thank you for this audit
[50:51] because we do not have a
[50:52] full-time p card administrator and
[50:54] the work
[50:57] that a p-card
[51:02] administrator does do is obviously
[51:03] missing
[51:04] some things because of the resource
[51:05] factor. I was happy to have this audit
[51:06] done
[51:09] so we could identify the gaps or,
[51:10] rather, have someone else identify them for
[51:12] us so we could start figuring out
[51:14] what to do about these. In this case, we
[51:15] did not have a
[51:19] transaction approver trainee. I saw
[51:21] that when I came in because someone
[51:24] told me what to do but there was no
[51:25] training on specifically what to look
[51:27] for and I think this lack
[51:30] of training
[51:33] is also an indirect cause
[51:36] of some of the other issues
[51:39] that luke brought up especially, for
[51:40] instance, the fact
[51:42] that receipts are not
[51:44] uniformly attached. If we don't train
[51:45] the approvers that
[51:48] they are supposed to
[51:51] make sure
[51:52] that the receipts are attached, then
[51:53] that is an issue. We are definitely
[51:54] working
[51:56] on that. I am working with todd and
[51:57] tina to come up with what
[51:58] should be our training and we are
[52:00] working with people office
[52:06] as well.
[52:14] >> one other question I would have
[52:15] on it. Are these tax-exempt?
[52:17] are we tax exempt on this?
[52:18] >> yes.
[52:19] >> is that something that is being
[52:20] asked? The reason I ask that is because
[52:21] at the county, it is something we
[52:22] look very closely at, to make sure
[52:24] everybody is doing that. If not, there
[52:26] is a red flag that goes up on each
[52:27] one.
[52:28] >> we get a report from
[52:29] mike every month that he works with
[52:30] the comptroller's office to recover
[52:31] anything that
[52:33] has not been properly
[52:36] not taxed.
[52:37] >> how many
[52:39] millions did you
[52:41] say is annually on each cards? See
[52:42] the most recent one was
[52:48] 13.5 million.
[52:49] >>
[52:50] so if that is the total amount. I
[52:51] was asking for the number of transactions on
[52:53] an annual basis. Do you know that?
[52:54] >> I don't know about annual but
[53:00] hour period covered --I could give
[53:01] you an exact
[53:03] number. It
[53:06] was 136,599.
[53:07] >> total transactions?
[53:08] >> total transactions. >> we will rounded
[53:09] up to 600.
[53:12] >> mike, to bob's question, if
[53:15] the sales
[53:18] tax is paid and it is
[53:21] paid in utah, anyway, then that
[53:24] is recoverable through
[53:26] filing with the tax commission, correct?
[53:27] >> it is. We
[53:30] work with --like I said, we work with
[53:31] the comptroller
[53:33] to
[53:36] do that and they have a regular cadence for
[53:38] going back to the tax commission and
[53:39] getting those
[53:45] funds back.
[53:46] >> it should
[53:47] be noted that that is contained within
[53:48] the p-card basic training, you have
[53:49] information about being tax-exempt.
[53:50] >> I would just think that with that
[53:51] total many dollars and
[53:54] that
[53:57] many transactions,
[54:02] that is not an easy task to watch that but
[54:03] I would say that
[54:06] has got
[54:09] to be open and not
[54:10] accusing anybody but it definitely
[54:12] opens it up for there to be some
[54:13] type of fraud going on someplace as
[54:15] far as that goes. That is a lot of
[54:17] things that could be being charged. They
[54:18] are not all being looked at
[54:21] very,
[54:24] very closely.
[54:25] >> certainly
[54:27] fraud is --fraud and also
[54:30] accidental personal purchases are always
[54:36] a possibility
[54:39] and I've got to choose my
[54:42] words carefully. We didn't find any
[54:45] evidence of widespread or
[54:48] egregious fraud in
[54:51] our procedures. Separate from
[54:54] this audit, my
[54:57] team also --we also do a
[55:00] number of other things that gets our
[55:03] eyes on p-card
[55:06] transactions.
[55:08] for one, the sales tax thing. Because
[55:09] of that, we reviewed
[55:12] just about every transaction. We,
[55:13] on
[55:15] a quarterly basis,
[55:18] we review
[55:21] p-cards, specifically looking for duplicate
[55:22] transaction. That gets us
[55:23] pulling reports, seeing what is being
[55:24] spent . I also have
[55:28] a
[55:31] monitoring report
[55:34] --
[55:35] credit cards have what is called an
[55:36] mcc code, merchant category code.
[55:37] every company has an
[55:39] associated code. For instance, walmart
[55:40] or
[55:43] a department or
[55:44] store, mcdonald's would be fast food, et
[55:45] cetera. I have flagged some of the
[55:49] high risk
[55:50] type mcc codes and I have a report
[55:55] sent right to my
[55:56] email box. I get it just about every morning
[55:58] of any transactions that hit up
[56:00] against that and then I can review
[56:01] it and see
[56:04] if any follow-up
[56:07] is
[56:10] needed. So,
[56:12] nobody can guarantee that an environment is
[56:13] 100% free
[56:16] from fraud. As long
[56:18] as people are involved in any process,
[56:19] that promise can't be
[56:22] made but,
[56:28] our internal audit, both in
[56:29] this audit and through all of those
[56:31] other activities I
[56:36] have described, we have seen enough that
[56:37] I am confident
[56:38] that we don't have systemic or widespread
[56:39] fraud going on within our purchase
[56:46] card program.
[56:53] >> also, if I could touch base on
[56:54] this. Since I have joined us in 2023, we have
[56:55] also reduced significantly the number
[56:57] of p-cards being held. I don't know
[56:58] if you want
[56:59] to touch on that quickly or not.
[57:00] >>
[57:01] on
[57:04] the training, I have
[57:05] noticed this a little bit, and thank
[57:07] you, bob for being here. I am
[57:10] hoping that
[57:13] it includes
[57:16] --if you have a business meal,
[57:17] the purpose of the business meal,
[57:18] those types of things. It seems intrinsic
[57:19] if you
[57:20] have lived at your whole life but if
[57:22] you haven't, somebody may not realize
[57:25] those are
[57:26] the things they actually need to be
[57:28] submitting on the
[57:29] documentation and I am wondering if
[57:31] those things should also
[57:34] be included.
[57:35] >> those things
[57:36] are absolutely being considered. We
[57:37] recognize from this audit that we
[57:38] need not just to
[57:39] establish some training portals for
[57:40] specific things but
[57:46] also retraining.
[57:49] the receipts for when there are
[57:50] meals, one, they are not supposed
[57:52] to be single person
[57:53] meals and two, they are supposed to put
[57:54] on the receipt who was in attendance at
[57:55] the
[57:58] meal. Right? So, also making
[58:01] sure
[58:03] that the senior person who was in
[58:04] attendance at the meal
[58:07] is the person who uses
[58:09] the card. We definitely need to do
[58:10] some retraining
[58:13] and we are working
[58:16] on that.
[58:17] >> with that, are there any
[58:18] questions
[58:19] on
[58:22] this slide? You can skip to the next
[58:23] one which is totally fine because
[58:25] we did find a
[58:27] number of potential purchases where
[58:28] it was an
[58:29] individual meal or when that would
[58:31] not fall
[58:33] within policy. As noted, they recognize
[58:37] the ability
[58:38] to improve that process and create
[58:40] some better documentation for
[58:43] that and training.
[58:46] any additional
[58:49] questions there?
[58:50] >>
[58:52] the last one
[58:55] is issue 25-03-08
[59:01] where the issue is purchase transactions lacked
[59:04] detailed information required
[59:07] by policy.
[59:10] so, a few different things there.
[59:11] as mike noted, there were 137,600
[59:12] transactions, I think. So, 85,068
[59:13] of them
[59:15] were 62% did not really have a description
[59:16] as required, written
[59:19] in the u.s.
[59:22] bank
[59:24] system. 4412 were missing receipts
[59:25] and
[59:28] then 3039 did not have any recorded approvals from
[59:31] a supervisor or
[59:34] transaction
[59:40] approver.
[59:41] >> I was going
[59:43] to ask, how does it go
[59:46] on
[59:49] that long?
[59:52] the system, having used it, if somebody doesn't approve
[59:53] it,
[59:55] it doesn't always come to the
[59:56] approver but at some point, somebody
[59:58] should flagged that as
[1:00:01] lack of
[1:00:02] action by the cardholder. I am just
[1:00:04] wondering how does that
[1:00:06] get resolved?
[1:00:07] >> again, retraining, absolutely
[1:00:10] require it
[1:00:12] but in some cases, there are a couple
[1:00:13] of things going on here
[1:00:16] where the auto populated
[1:00:19] piece in u.s.
[1:00:22] bank allows people to think
[1:00:25] that the
[1:00:27] field has been completed so they just
[1:00:28] approve it or they just let
[1:00:31] it go. The other is, in
[1:00:33] some cases where the information has
[1:00:37] become an issue where
[1:00:40] the manager has not approved
[1:00:42] it and the two cycles that they are provided and then
[1:00:43] the
[1:00:46] card
[1:00:48] is shut off and then they go in and
[1:00:49] they fix and the card is turned back
[1:00:52] on, it doesn't automatically
[1:00:54] wipe up --out the stuff that wasn't approved
[1:00:55] the
[1:01:00] prior times. Sometimes it is just
[1:01:01] a communication issue. Sometimes it
[1:01:02] is a
[1:01:04] system issue. Sometimes it is a people
[1:01:05] issue.
[1:01:06] we are working on that. One of the
[1:01:07] things that I wanted to
[1:01:10] bring up is that we are working with
[1:01:11] a vendor
[1:01:13] that is coming in next week to give
[1:01:14] --
[1:01:15] I believe the meeting is next week,
[1:01:16] just to give us
[1:01:19] a discussion, right?
[1:01:22] of what kinds of things we
[1:01:25] could be looking for in a p-card
[1:01:28] management vendor because
[1:01:31] there are ways that we could
[1:01:36] structure this so that we could send
[1:01:37] a list of our active
[1:01:40] employees and they
[1:01:43] automatically roll
[1:01:45] it through the system and so the ones who
[1:01:46] are no longer active,
[1:01:47] they automatically turn those cards
[1:01:49] off so even if somebody doesn't turn
[1:01:50] in their card,
[1:01:52] they won't have access to spend against
[1:01:53] it.
[1:01:54] there are options where they could
[1:01:55] set up, instead of a card, they have
[1:01:56] a
[1:01:58] replenished account where
[1:02:01] you don't --for those cardholders
[1:02:02] who have cards
[1:02:03] because they travel once a year to
[1:02:09] a conference , they are not going
[1:02:10] to have any option
[1:02:12] but to turn the card on for that conference,
[1:02:13] right? Otherwise, you would have to
[1:02:14] go through your management to say,
[1:02:16] I am going to two conferences this
[1:02:17] year. Can you
[1:02:19] turn the card
[1:02:22] on for this other
[1:02:23] conference? There are options we have
[1:02:25] looked into because we know we don't
[1:02:26] have internal resources to
[1:02:27] do this full program the way it should
[1:02:28] be
[1:02:31] done and we are looking
[1:02:32] into those options at the same time
[1:02:34] as improving our
[1:02:37] training protocols.
[1:02:38] >>
[1:02:43] anything else?
[1:02:44] >> I mean, there is
[1:02:45] a second slide of recommendations
[1:02:46] but I think most were addressed in
[1:02:47] the comments
[1:02:49] just now. It should also be
[1:02:51] noted that management and everybody was
[1:02:53] very helpful in
[1:02:58] this audit. It went very well, very
[1:02:59] smoothly as
[1:03:00] meetings were requested or information
[1:03:05] was requested
[1:03:07] . The team is aware that there are some areas
[1:03:08] that probably needed some improvement
[1:03:09] and they were very helpful throughout
[1:03:11] the
[1:03:12] whole process. It has been a good
[1:03:13] process that way.
[1:03:14] >> viola, what you
[1:03:15] see is
[1:03:16] the timeframe for getting into some
[1:03:20] kind
[1:03:23] of overall --
[1:03:24] >>
[1:03:25] the end of this year is the plan. There
[1:03:26] are couple of things we were able
[1:03:27] to do immediately like restricting
[1:03:29] who
[1:03:31] has approvals. Now, that is set by
[1:03:32] the p-card
[1:03:35] administrator and not by the
[1:03:41] individual cardholder.
[1:03:43] there are some compliance audits and we
[1:03:44] are checking
[1:03:45] those right now to see who is outside of
[1:03:46] the compliance as far as not taking
[1:03:47] the training. Those immediate things
[1:03:49] are being done and then the training
[1:03:50] and finding some
[1:03:51] vendor support is going to be at the
[1:03:53] end of the year.
[1:03:56] >> okay. Questions for vi
[1:03:59] or staff?
[1:04:02] okay.
[1:04:03] >> I have one thing to add
[1:04:04] that you brought up in the beginning
[1:04:05] which was about the packages
[1:04:08] being sent
[1:04:11] to non-uta addresses. Again, that is
[1:04:12] another training issue but I wanted to
[1:04:14] bring up that of
[1:04:17] the
[1:04:18] numbers, two people were responsible
[1:04:23] for 60% of those
[1:04:24] transactions so those two people have been
[1:04:26] identified and those
[1:04:28] specific retraining's but it wasn't
[1:04:29] everyone
[1:04:33] running amok.
[1:04:34] >> I actually did not
[1:04:35] think you could go to
[1:04:37] a non-uta address. I know you can
[1:04:41] but from the policy
[1:04:43] standpoint. Mini from a policy standpoint
[1:04:44] it is
[1:04:47] not supposed to
[1:04:48] happen but the thing is, when you
[1:04:49] order on amazon, sometimes you just
[1:04:50] forget
[1:04:53] to change it from your personal. They
[1:04:55] are supposed to be using our business
[1:05:01] amazon account.
[1:05:02] >> okay. >> that is helpful.
[1:05:03] it
[1:05:04] takes out the sales tax, anyway.
[1:05:05] >> exactly.
[1:05:06] >> okay.
[1:05:08] with that, mike, anything
[1:05:10] else from your end?
[1:05:11] >> nothing else.
[1:05:12] >> our next meeting
[1:05:14] will be on monday, december 15
[1:05:17] at 3:00.
[1:05:20] we do --
[1:05:22] let's see. We do have a closed session
[1:05:29] to discuss a strategy session to
[1:05:31] discuss topics as defined in the utah
[1:05:32] code in regards to
[1:05:34] deployment of security personnel,
[1:05:35] services or
[1:05:37] systems and that particular meeting
[1:05:43] will be in our map room. With that,
[1:05:44] I entertain
[1:05:47] a motion to go into
[1:05:51] closed session.
[1:05:52] >> so moved to go into
[1:05:53] closed session.
[1:05:54] >> second. >> I have a
[1:05:55] motion from jeff, seconded by beth
[1:05:56] to go
[1:05:59] into
[1:06:01] closed session. All in favor say aye.
[1:06:02] >> aye. >>
[1:06:03] any opposed?
[1:06:04] >> that motion
[1:06:05] passes. We will plan to see everybody
[1:06:06] there in five minutes at a
[1:06:08] quarter after.
[1:06:10] >>> we have returned our closed
[1:06:13] session and with
[1:06:15] that, we will take a final motion of adjournment.
[1:06:22] >> motion. >>
[1:06:24] second.
[1:06:25] >> motion and a second. All
[1:06:26] in favor say aye.
[1:06:27] >> aye.
[1:06:28] >> any opposed? >> we stand adjourned.